CVE-2025-31689: Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability

April 1, 2025 (updated April 29, 2025)

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery. This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

References

git.drupalcode.org/project/gdpr
git.drupalcode.org/project/gdpr/-/commit/d53f1cf1394c41c8885faaaaf576965161676e1f
github.com/advisories/GHSA-jv6r-mj9p-9xff
nvd.nist.gov/vuln/detail/CVE-2025-31689
www.drupal.org/sa-contrib-2025-018

Code Behaviors & Features

Detect and mitigate CVE-2025-31689 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →